📦 Curl

by Haxx

🔍 What is Curl?

curl is a command-line tool and library for transferring data with URLs. It supports numerous protocols including HTTP, HTTPS, FTP, and more, making it essential for API testing, web scraping, and automated data transfers.

🛡️ Security Overview

Click on a severity to filter vulnerabilities

⚠️ Known Vulnerabilities

CVE-2025-0665

CRITICAL CVSS 9.8 Feb 5, 2025

libcurl incorrectly closes the same eventfd file descriptor twice during threaded name resolution cleanup, causing a use-after-free condition. This vulnerability affects applications using libcurl wit...

CVE-2023-23914

CRITICAL CVSS 9.1 Feb 23, 2023

A vulnerability in curl versions before 7.88.0 causes HSTS (HTTP Strict Transport Security) to fail when processing multiple URLs sequentially on the same command line. This allows sensitive informati...

CVE-2022-32221

CRITICAL CVSS 9.8 Dec 5, 2022

This vulnerability in libcurl allows an attacker to cause memory corruption or data leakage when reusing a handle from a PUT to a POST request. Applications using libcurl for HTTP(S) transfers with re...

CVE-2022-32207

CRITICAL CVSS 9.8 Jul 7, 2022

CVE-2022-32207 is a privilege escalation vulnerability in curl versions before 7.84.0 where file permission widening occurs during atomic file operations. When curl saves cookies, alt-svc, or hsts dat...

CVE-2025-5399

HIGH CVSS 7.5 Jun 7, 2025

A denial-of-service vulnerability in libcurl's WebSocket implementation allows a malicious server to send a crafted packet that traps libcurl in an endless busy-loop. This affects any application usin...

CVE-2024-2398

HIGH CVSS 8.6 Mar 27, 2024

CVE-2024-2398 is a memory leak vulnerability in libcurl that occurs when HTTP/2 server push headers exceed the 1000-header limit. This allows attackers to cause denial of service through resource exha...

CVE-2023-38039

HIGH CVSS 7.5 Sep 15, 2023

CVE-2023-38039 is a memory exhaustion vulnerability in curl/libcurl where a malicious server can send unlimited HTTP headers, causing curl to consume all available heap memory and crash. This affects ...

CVE-2023-28319

HIGH CVSS 7.5 May 26, 2023

CVE-2023-28319 is a use-after-free vulnerability in curl/libcurl versions before 8.1.0 that occurs during SSH server public key verification. When verification fails, curl frees memory containing the ...

CVE-2023-27534

HIGH CVSS 8.8 Mar 30, 2023

A path traversal vulnerability in curl's SFTP implementation allows attackers to bypass path filtering by using specially crafted paths containing tilde characters. This affects curl versions before 8...

CVE-2023-27533

HIGH CVSS 8.8 Mar 30, 2023

A vulnerability in curl versions before 8.0 allows attackers to inject malicious content during TELNET protocol negotiation when user input is accepted. This could lead to arbitrary code execution on ...

CVE-2022-27780

HIGH CVSS 7.5 Jun 2, 2022

The curl URL parser incorrectly accepts percent-encoded URL separators like '/' in hostnames, allowing attackers to bypass filters and checks by making malicious URLs appear legitimate. This affects a...

CVE-2022-27782

HIGH CVSS 7.5 Jun 2, 2022

libcurl incorrectly reuses TLS/SSH connections when security settings have changed, potentially allowing sensitive data to be transmitted over less secure connections. This affects any application usi...

CVE-2022-27775

HIGH CVSS 7.5 Jun 2, 2022

This curl vulnerability allows information disclosure when an attacker can force curl to reuse an existing IPv6 connection from the pool with a different zone identifier, potentially exposing sensitiv...

CVE-2022-27778

HIGH CVSS 8.1 Jun 2, 2022

This vulnerability in curl versions before 7.83.1 could cause the wrong file to be deleted when using the --no-clobber option with --remove-on-error. It affects systems using curl with these specific ...

CVE-2021-22926

HIGH CVSS 7.5 Aug 5, 2021

This vulnerability allows attackers to trick libcurl applications into using a malicious client certificate instead of the intended one when running in writable directories like /tmp. It affects appli...

CVE-2021-22901

HIGH CVSS 8.1 Jun 11, 2021

CVE-2021-22901 is a use-after-free vulnerability in curl/libcurl that allows a malicious TLS 1.3 server to potentially execute arbitrary code on the client. This affects curl clients using OpenSSL wit...

CVE-2025-15079

MEDIUM CVSS 5.3 Jan 8, 2026

This vulnerability in libcurl allows SSH-based transfers (SCP/SFTP) to accept connections to hosts not listed in the specified known_hosts file if those hosts exist in the global libssh known_hosts fi...

CVE-2025-14524

MEDIUM CVSS 5.3 Jan 8, 2026

This vulnerability in curl allows OAuth2 bearer tokens to be incorrectly passed during cross-protocol redirects from HTTP(S) to IMAP, LDAP, POP3, or SMTP protocols. Attackers could potentially interce...

CVE-2025-14819

MEDIUM CVSS 5.3 Jan 8, 2026

A TLS certificate validation vulnerability in libcurl where reusing easy or multi handles with altered CURLSSLOPT_NO_PARTIALCHAIN options could cause libcurl to incorrectly reuse cached CA stores with...

CVE-2025-14017

MEDIUM CVSS 6.3 Jan 8, 2026

CVE-2025-14017 is a thread safety vulnerability in libcurl's LDAPS implementation where TLS option changes in one thread affect all concurrent LDAPS transfers globally. This allows disabling certifica...

CVE-2025-13034

MEDIUM CVSS 5.9 Jan 8, 2026

A certificate pinning bypass vulnerability in curl allows attackers to impersonate servers when specific conditions are met. The vulnerability affects users who explicitly disable standard certificate...

CVE-2025-10966

MEDIUM CVSS 4.3 Nov 7, 2025

CVE-2025-10966 is a vulnerability in curl's SSH connection management when using SFTP with the wolfSSH backend, where host verification mechanisms were missing. This allows man-in-the-middle (MITM) at...

CVE-2025-10148

MEDIUM CVSS 5.3 Sep 12, 2025

A vulnerability in curl's WebSocket implementation uses a fixed 32-bit mask pattern for all outgoing frames instead of generating new random masks per frame as required by the WebSocket specification....

CVE-2025-4947

MEDIUM CVSS 6.5 May 28, 2025

libcurl versions 8.9.0 through 8.10.0 fail to verify TLS certificates for QUIC connections when URLs contain IP addresses instead of hostnames. This allows man-in-the-middle attackers to intercept and...

CVE-2025-15224

LOW CVSS 3.1 Jan 8, 2026

Curl incorrectly uses SSH agent authentication for SCP/SFTP transfers even when explicitly configured for public key authentication. This allows attackers with access to the SSH agent to authenticate ...

CVE-2023-28322

LOW CVSS 3.7 May 26, 2023

This vulnerability in curl versions before 8.1.0 causes information disclosure when reusing a handle between PUT and POST requests. It affects applications using libcurl for HTTP(S) transfers where th...